Is there a way to ensure that an HTTP request to my REST server is coming from my application? I'm guessing no because whatever I do on the client side, as people have access to that code, they can figure out what I'm doing, and do the same.

Is it a valid approach to always use HTTPS (to stop prying eyes) and then require that any request includes a password we provide to each valid user? Or does that not work well in practice?

Or is there anything else we can do? We're not worried about encrypting or signing the data in the request, just verifying that it is coming from who claims they are sending it.

In our case, it is always a POST that sends us a query in an XML document so we can easily add an attribute to the XML.

merged by Rory Alsop Nov 3 '14 at 19:13

This question was merged with Is it fundamentally possible to validate that an unmodified version of your client connects to your server? because it is an exact duplicate of that question.

Browse other questions tagged or ask your own question.